Overview

overview

10

Static

static

10

9e1e76c4fd...79.exe

windows10-2004-x64

10

9e1e76c4fd...79.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9e1e76c4fdec7452284fba2b74db92f05ff9ad233e3f0da85cb6dca9e5af3e79.bin
  • Size 2.0MB
  • Sample260802-sp99bswape
  • SHA256 9e1e76c4fdec7452284fba2b74db92f05ff9ad233e3f0da85cb6dca9e5af3e79
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
ratcosturapackerdefaultasyncrat

Malware Config

Extracted

Family

  • asyncrat

Version

  • LoaderPanel

Botnet

  • Default

C2

  • mhiaofhaifs.click:6565

  • mhiascjaoecj.click:6565

  • mhiaohcaffs.click:6565

Mutex

  • ikerkpuzfdb

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Costura .NET executable packer 1 IoCs

    Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

    costurapacker
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 9e1e76c4fdec7452284fba2b74db92f05ff9ad233e3f0da85cb6dca9e5af3e79.bin
    .exe 2.0MB
  • costura.dll
    .dll 5KB
  • costura.pdb
    7KB
  • microsoft.win32.primitives.dll
    .dll 20KB
  • netstandard.dll
    .dll 96KB
  • packetlib.dll
    .dll 15KB
  • packetlib.pdb
    27KB
  • system.appcontext.dll
    .dll 20KB
  • system.collections.concurrent.dll
    .dll 20KB
  • system.collections.dll
    .dll 21KB
  • system.collections.nongeneric.dll
    .dll 20KB
  • system.collections.specialized.dll
    .dll 20KB
  • system.componentmodel.dll
    .dll 20KB
  • system.componentmodel.eventbasedasync.dll
    .dll 21KB
  • system.componentmodel.primitives.dll
    .dll 21KB
  • system.componentmodel.typeconverter.dll
    .dll 22KB
  • system.console.dll
    .dll 20KB
  • system.data.common.dll
    .dll 150KB
  • system.diagnostics.contracts.dll
    .dll 21KB
  • system.diagnostics.debug.dll
    .dll 20KB
  • system.diagnostics.fileversioninfo.dll
    .dll 20KB
  • system.diagnostics.process.dll
    .dll 21KB
  • system.diagnostics.stacktrace.dll
    .dll 23KB
  • system.diagnostics.textwritertracelistener.dll
    .dll 20KB
  • system.diagnostics.tools.dll
    .dll 20KB
  • system.diagnostics.tracesource.dll
    .dll 21KB
  • system.diagnostics.tracing.dll
    .dll 30KB
  • system.drawing.primitives.dll
    .dll 20KB
  • system.dynamic.runtime.dll
    .dll 21KB
  • system.globalization.calendars.dll
    .dll 21KB
  • system.globalization.dll
    .dll 20KB
  • system.globalization.extensions.dll
    .dll 25KB
  • system.io.compression.dll
    .dll 108KB
  • system.io.compression.zipfile.dll
    .dll 20KB
  • system.io.dll
    .dll 20KB
  • system.io.filesystem.dll
    .dll 20KB
  • system.io.filesystem.driveinfo.dll
    .dll 20KB
  • system.io.filesystem.primitives.dll
    .dll 20KB
  • system.io.filesystem.watcher.dll
    .dll 20KB
  • system.io.isolatedstorage.dll
    .dll 20KB
  • system.io.memorymappedfiles.dll
    .dll 20KB
  • system.io.pipes.dll
    .dll 20KB
  • system.io.unmanagedmemorystream.dll
    .dll 20KB
  • system.linq.dll
    .dll 20KB
  • system.linq.expressions.dll
    .dll 21KB
  • system.linq.parallel.dll
    .dll 20KB
  • system.linq.queryable.dll
    .dll 20KB
  • system.net.http.dll
    .dll 193KB
  • system.net.nameresolution.dll
    .dll 20KB
  • system.net.networkinformation.dll
    .dll 21KB
  • system.net.ping.dll
    .dll 20KB
  • system.net.primitives.dll
    .dll 21KB
  • system.net.requests.dll
    .dll 20KB
  • system.net.security.dll
    .dll 21KB
  • system.net.sockets.dll
    .dll 29KB
  • system.net.webheadercollection.dll
    .dll 20KB
  • system.net.websockets.client.dll
    .dll 20KB
  • system.net.websockets.dll
    .dll 20KB
  • system.objectmodel.dll
    .dll 21KB
  • system.reflection.dll
    .dll 21KB
  • system.reflection.extensions.dll
    .dll 20KB
  • system.reflection.primitives.dll
    .dll 21KB
  • system.resources.reader.dll
    .dll 20KB
  • system.resources.resourcemanager.dll
    .dll 20KB
  • system.resources.writer.dll
    .dll 20KB
  • system.runtime.compilerservices.visualc.dll
    .dll 21KB
  • system.runtime.dll
    .dll 28KB
  • system.runtime.extensions.dll
    .dll 21KB
  • system.runtime.handles.dll
    .dll 20KB
  • system.runtime.interopservices.dll
    .dll 23KB
  • system.runtime.interopservices.runtimeinformation.dll
    .dll 27KB
  • system.runtime.numerics.dll
    .dll 20KB
  • system.runtime.serialization.formatters.dll
    .dll 20KB
  • system.runtime.serialization.json.dll
    .dll 20KB
  • system.runtime.serialization.primitives.dll
    .dll 26KB
  • system.runtime.serialization.xml.dll
    .dll 24KB
  • system.security.claims.dll
    .dll 20KB
  • system.security.cryptography.algorithms.dll
    .dll 45KB
  • system.security.cryptography.csp.dll
    .dll 20KB
  • system.security.cryptography.encoding.dll
    .dll 20KB
  • system.security.cryptography.primitives.dll
    .dll 21KB
  • system.security.cryptography.x509certificates.dll
    .dll 22KB
  • system.security.principal.dll
    .dll 20KB
  • system.security.securestring.dll
    .dll 21KB
  • system.text.encoding.dll
    .dll 21KB
  • system.text.encoding.extensions.dll
    .dll 20KB
  • system.text.regularexpressions.dll
    .dll 20KB
  • system.threading.dll
    .dll 21KB
  • system.threading.overlapped.dll
    .dll 36KB
  • system.threading.tasks.dll
    .dll 21KB
  • system.threading.tasks.parallel.dll
    .dll 20KB
  • system.threading.thread.dll
    .dll 20KB
  • system.threading.threadpool.dll
    .dll 20KB
  • system.threading.timer.dll
    .dll 20KB
  • system.valuetuple.dll
    .dll 77KB
  • system.xml.readerwriter.dll
    .dll 21KB
  • system.xml.xdocument.dll
    .dll 21KB
  • system.xml.xmldocument.dll
    .dll 21KB
  • system.xml.xmlserializer.dll
    .dll 21KB
  • system.xml.xpath.dll
    .dll 20KB
  • system.xml.xpath.xdocument.dll
    .dll 22KB

9e1e76c4fdec7452284fba2b74db92f05ff9ad233e3f0da85cb6dca9e5af3e79.bin

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 9e1e76c4fdec7452284fba2b74db92f05ff9ad233e3f0da85cb6dca9e5af3e79
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:4windowsx86arch:x86

  • Async RAT payload

    rat

  • Costura .NET executable packer

    Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

    costurapacker

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
1566654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE
PDB paths